CVE-2024-10900

Executive Summary

CVE-2024-10900 is a Missing Authorization vulnerability in the ProfileGrid – User Profiles, Groups and Communities WordPress plugin, affecting versions up to and including 5.9.3.6. The flaw resides in the pm_remove_file_attachment() function, which lacks a capability check, allowing authenticated attackers with subscriber-level access or higher to delete arbitrary user meta entries. This can be leveraged to remove critical user metadata, such as the wp_capabilities key for an administrator, effectively locking them out of the WordPress admin dashboard. The vulnerability has a CVSS score of 6.5 (Medium) and is currently unpatched. No public proof-of-concept or exploit code has been released, but the attack vector is straightforward for any authenticated user.

WordPress Ecosystem Context

This vulnerability is specific to the ProfileGrid plugin within the WordPress ecosystem. It does not affect the core WordPress software, Apache, or Nginx. The attack is performed via a crafted POST request to the WordPress AJAX endpoint, exploiting the missing capability check in the plugin's code.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs subscriber-level authentication.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Exploit does not affect other components.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): High (H) – Can delete arbitrary user meta, leading to denial of service.
• Availability (A): None (N) – Direct impact is on integrity, not availability.

Threat Level: Medium. While the CVSS score is 6.5, the potential to lock out administrators elevates the risk for WordPress sites using this plugin.

Deep Dive & Mechanics

The vulnerability exists in the pm_remove_file_attachment() function, which is registered as an AJAX action for both authenticated and unauthenticated users. The function is intended to allow users to remove their own file attachments, but it fails to verify that the user performing the action has the necessary capabilities to delete the targeted user meta entry.

Attack Flow:

1. An authenticated attacker (subscriber or above) sends a POST request to /wp-admin/admin-ajax.php with the action pm_remove_file_attachment.
2. The request includes parameters such as user_id (target user) and meta_key (the meta key to delete).
3. The function calls delete_user_meta($user_id, $meta_key) without checking if the current user has permission to modify that user's metadata.
4. By targeting the wp_capabilities meta key of an administrator, the attacker can remove the administrator's role, effectively locking them out of the admin dashboard.

Root Cause: Missing capability check (CWE-862) in the pm_remove_file_attachment() function. The plugin should verify that the current user is either the target user or has edit_users capability.

Vulnerable vs. Patched Code

Vulnerable Code (ProfileGrid <= 5.9.3.6):

function pm_remove_file_attachment() {
    $user_id = $_POST['user_id'];
    $meta_key = $_POST['meta_key'];
    delete_user_meta($user_id, $meta_key);
    wp_die();
}
add_action('wp_ajax_pm_remove_file_attachment', 'pm_remove_file_attachment');

Patched Code (Hypothetical Fix):

function pm_remove_file_attachment() {
    $user_id = intval($_POST['user_id']);
    $meta_key = sanitize_key($_POST['meta_key']);
    
    // Check if current user can edit the target user
    if ( ! current_user_can('edit_user', $user_id) ) {
        wp_die('Unauthorized');
    }
    
    delete_user_meta($user_id, $meta_key);
    wp_die();
}
add_action('wp_ajax_pm_remove_file_attachment', 'pm_remove_file_attachment');

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• WordPress site with ProfileGrid plugin <= 5.9.3.6.
• Attacker account with subscriber-level access.
• Target administrator user ID (e.g., 1).

Exploit Steps:

1. Obtain a valid nonce for the AJAX action (if required; the vulnerable code does not check nonces).
2. Send a crafted POST request:

curl -X POST http://target-site/wp-admin/admin-ajax.php \
  -d "action=pm_remove_file_attachment&user_id=1&meta_key=wp_capabilities" \
  --cookie "wordpress_logged_in_<hash>=<session_cookie>"

3. The administrator's wp_capabilities meta is deleted, removing their admin role.
4. The administrator is now unable to access /wp-admin/ and will be redirected to the login page.

Note: No public exploit code exists; this is a theoretical attack based on the vulnerability description.

Blue Team (Detection & Defense)

Detection:

• Monitor AJAX requests to admin-ajax.php with action pm_remove_file_attachment.
• Alert on requests where user_id differs from the authenticated user's ID.
• Log all delete_user_meta operations for critical meta keys like wp_capabilities.

Defense:

• Immediately disable the ProfileGrid plugin until a patch is released.
• Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with action=pm_remove_file_attachment from non-admin users.
• Use a security plugin (e.g., Wordfence) to monitor and block unauthorized user meta modifications.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with body containing action=pm_remove_file_attachment.
  • Repeated requests with varying user_id and meta_key parameters.
• System IOCs:
  • Missing wp_capabilities user meta for administrator accounts.
  • Unexpected user role changes (e.g., admin becomes subscriber).
• Log IOCs:
  • WordPress debug log entries showing delete_user_meta calls for wp_capabilities.
  • Failed login attempts from legitimate administrators after meta deletion.

Detection Engineering

YARA Rule

rule Detect_CVE_2024_10900_Exploit {
    meta:
        description = "Detects exploitation attempts for CVE-2024-10900 in ProfileGrid plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-10900"
    strings:
        $ajax_action = "pm_remove_file_attachment"
        $meta_key = "wp_capabilities"
        $user_id_param = "user_id"
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-10900 ProfileGrid Unauthorized User Meta Deletion
id: 8a3f7c2e-5d1b-4a9f-8c6e-2b1d3f4a5c6e
status: experimental
description: Detects attempts to exploit missing capability check in ProfileGrid plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=pm_remove_file_attachment'
    condition: selection
falsepositives:
    - Legitimate plugin functionality (if patched)
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2024-10900 ProfileGrid Unauthorized User Meta Deletion Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=pm_remove_file_attachment"; http_client_body;
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the ProfileGrid plugin until a security patch is released by the vendor.
2. Audit user accounts for any unauthorized meta deletions, especially wp_capabilities.
3. Restore deleted meta for affected administrators via database query:

INSERT INTO wp_usermeta (user_id, meta_key, meta_value)
VALUES (1, 'wp_capabilities', 'a:1:{s:13:"administrator";b:1;}');

Long-Term Mitigation:

• Monitor the ProfileGrid plugin page for updates and apply the patch immediately when available.
• Implement a Web Application Firewall (WAF) with custom rules to block exploitation attempts.
• Enforce the principle of least privilege for all WordPress user roles.
• Regularly backup the WordPress database to enable quick recovery from such attacks.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.